Cracking CrackIt(crackmes.one): A Step-by-Step Reverse Engineering Walkthrough

Overview

This writeup explains how I solved the crackme binary crackit. The program expects a flag as a command-line argument and prints a success message if the correct flag is provided.

usage: ./crackit <flag>

The goal of the challenge is to determine the correct flag that triggers the success message:

You cracked me!

Step 1 — Identify the Binary

First I checked the type of the binary using the file command.

file crackit
Output: ELF 64-bit LSB pie executable, x86–64, dynamically linked, stripped

Step 2 — Run the Program

Running the binary without arguments:

./crackit
Output: usage: ./crackit <flag>

Providing a random argument:

./crackit test
Ouput: Try again, You can do it!

This indicates the program compares the provided argument with a hidden flag.

Step 3 — Inspect Strings

Next I inspected the binary for interesting strings.

strings crackit
Some suspicious strings were found:
CTF{
r3t_
Fl4g
}W0W
F0und
{0r
N0t}

However, these fragments did not immediately reveal the full flag.

Step 4 — Dynamic Analysis

To better understand the behavior of the program, I used ltrace to observe library calls.

ltrace ./crackit test
The trace revealed that the program constructs a string using multiple calls to strlen, memcpy, and std::string::append.

Relevant fragments from the trace:

"CTF{"
"My_"
"S3c"
"r3t_"
"Fl4g"
"}W0W"
"Y0u"
"F0und"
"M3"
"{0r "
"N0t}"

The reconstructed flag becomes:

CTF{My_S3cr3t_Fl4g}W0WY0uF0undM3{0r N0t}

Step 6 — Verify the Flag

Running the binary with the reconstructed flag:

./crackit 'CTF{My_S3cr3t_Fl4g}W0WY0uF0undM3{0r N0t}'
Output: You cracked me!